Anti-money laundering is not a model, a transaction score or an alert queue. It is the operating framework through which banks satisfy regulatory obligations to identify, assess, monitor, investigate and report potential money laundering and related financial crime. The exact requirements vary by jurisdiction, but the foundations reflected in the FATF Recommendations are broadly consistent: risk assessment and governance, customer and beneficial-owner due diligence, ongoing monitoring, investigation and escalation, suspicious activity or transaction reporting, recordkeeping and evidence that the controls operate effectively.
That description matters because it immediately exposes the weakness in asking whether “AML” should operate in real time. AML is not one activity and it does not support one decision. A customer risk assessment may remain valid for months. Transaction-monitoring models may accumulate behaviour over days or weeks. Investigations require evidence and judgement. A suspicious activity report is filed when the applicable threshold has been reached, not every time an individual transaction looks unusual.
Sanctions screening is the obvious exception. A valid sanctions match may require a payment to be stopped, rejected or the funds blocked before processing. The transaction-time requirement is therefore inherent in the obligation. But excluding sanctions screening has often led to the opposite overstatement: that because most AML work is retrospective, nothing else within AML needs to influence a payment in real time.
Mule accounts show why that conclusion is too broad.
AML does not operate on one clock
The debate becomes clearer when AML is decomposed into the decisions it supports. Customer due diligence establishes who the bank is dealing with, who ultimately owns or controls an entity, the purpose of the relationship and the activity that should reasonably be expected. Ongoing monitoring looks for material changes. Rules, models and typologies identify activity that warrants investigation. Analysts establish context, document their conclusions and determine whether a SAR or STR should be filed with the relevant financial intelligence unit.
These controls are connected, but they operate across different horizons. Their value does not come from forcing them all into the transaction path. It comes from ensuring that the intelligence produced by one control is available when another consequential decision is made.
The same is true of AML typologies. Structuring becomes visible through repeated activity designed to remain below reporting or control thresholds. Circular movement may require a graph of connected accounts and entities. Shell-company activity and trade-based money laundering often depend on understanding ownership, commercial purpose, documentation and behaviour over an extended period. Making an individual payment decision in five milliseconds does not solve those problems.
Mule and pass-through accounts operate differently. Their role is often to receive criminal proceeds and move them again before the funds can be identified, restrained or recovered. Rapid layering has the same time-sensitive characteristic. The relevant pattern may emerge through the relationship between an inbound payment, the receiving account and an attempted outbound transfer only seconds or minutes later.
Most AML typologies do not belong in the transaction path. Mule-account dispersal is different because the bank’s ability to change the outcome may expire with the next payment.
The objection is aimed at the wrong decision
The familiar objection to real-time AML is that transaction monitoring, investigation and regulatory reporting do not need to happen inside the payment path. That is correct, but it answers the wrong question.
The bank is not being asked to complete a money-laundering investigation before processing every payment. It is being asked whether intelligence already available about the customer, account, incoming funds and connected network should influence a new outbound transaction when the account begins behaving like a conduit.
At the inbound stage, the evidence may be ambiguous. At the outbound stage, the bank has additional context: the source and timing of the incoming funds, the account’s recent behaviour, the proportion of the balance being depleted, the novelty of the beneficiary, device or session changes and connections to known risk. The bank is not retrospectively reversing the inbound transaction. It is making a fresh decision about whether to permit the money to move again.
A bank can identify the activity later, investigate it correctly and file a valid SAR or STR. It may still have approved the transaction that placed the funds beyond recovery. A compliant report filed tomorrow does not compensate for an avoidable onward transfer approved today.
The account that turns fraud into proceeds
Consider an authorised push-payment scam. A victim is manipulated into transferring money to an account controlled directly or indirectly by a criminal. The originating bank must decide whether the payment is consistent with the customer’s behaviour and intent, whether the beneficiary appears risky and whether intervention is justified before releasing the funds.
The receiving bank sees a different part of the journey. Its customer may be newly onboarded, previously dormant or apparently ordinary when viewed in isolation. The incoming payment may be unusual in value, source or timing, but an unusual credit is not proof of money laundering. The funds may nevertheless remain in the account for only a few minutes before being split among new beneficiaries, transferred to another institution, withdrawn as cash, used to purchase an asset or converted into another form of value.
The scam creates the victim’s loss. The mule account turns that loss into accessible criminal proceeds. It gives the fraudster somewhere to receive the money and a route through which to separate it from the original crime. The UK Financial Conduct Authority describes money mules as integral to moving and cashing out the proceeds of fraud, often through interconnected accounts across financial institutions.
Mule accounts do not cause the underlying deception. They are the mechanism through which its proceeds are received, dispersed and monetised. That places them squarely between fraud and AML. Fraud explains how the money entered the account. AML intelligence helps explain the account, its network and the purpose of the movement that follows.
The inbound payment is context for the outbound decision
The receiving bank may not have enough evidence to act when the inbound payment arrives. Blocking legitimate incoming funds on the basis of weak suspicion would create obvious customer harm. The more useful question is what the inbound payment should mean when the account attempts to move the money again.
An account receives a large payment inconsistent with its previous activity. It has recently changed its access device, has links to other accounts displaying suspicious behaviour or has received funds from several unrelated parties. Shortly afterwards, the customer attempts to transfer most of the balance to a new beneficiary. The inbound event may have been ambiguous. Receipt followed by rapid depletion is a different proposition.
This distinction is central to the onward-hop argument. The inbound payment enriches the bank’s understanding of the account. The outbound payment creates the intervention point. A bank may not be able to conclude that the incoming funds are criminal proceeds, but it should not assess the next payment as though the previous event had told it nothing.
The first transaction explains the emerging risk. The next transaction determines whether the money can still be stopped.
Instant payments compressed the intervention window
Instant-payment systems were designed to make funds available quickly, continuously and with greater convenience. Pix in Brazil, UPI in India, Faster Payments in the United Kingdom, SCT Inst in Europe, FedNow and RTP in the United States, NPP in Australia, FAST in Singapore and SPEI in Mexico differ in governance, participation, messaging, clearing, settlement and dispute rules. They share one strategically important characteristic: the period between receipt and onward dispersal can be extremely short.
The market names familiar to customers are not always the underlying rails. Bizum is a bank-integrated, mobile-number payment experience that uses instant bank transfers in Spain. Zelle is a bank-network payment experience in the United States rather than a third instant-payment rail alongside FedNow and RTP. PayNow provides a customer and proxy-addressing experience over Singapore’s FAST infrastructure. These distinctions matter architecturally, but they do not change the control problem. Once money reaches the receiving account, the institution controlling that account has a narrow interval in which its next decision can still affect the funds.
Recovery and liability models vary significantly. The UK’s mandatory APP reimbursement arrangements split the cost of eligible reimbursement between sending and receiving payment firms. Brazil’s MED 2.0 is designed to identify possible paths taken by fraudulently obtained Pix funds and support recovery from accounts beyond the first recipient. Other markets allocate responsibilities differently. A global proposition cannot assume one liability regime, one recovery mechanism or one legal authority to delay or restrict a payment.
It can make a more durable assertion: instant payments reduce the time available to recognise that a receiving account may be acting as a conduit before the money moves beyond the institution’s control.
A shared network does not create a shared decision
An instant-payment system connects institutions, but it does not create a single fraud and AML decision engine. The sending bank knows the payer, the customer’s normal behaviour and the interaction through which the payment was initiated. The receiving bank knows the recipient, the account’s history, its recent inflows, its devices and its relationships with other accounts. If the money moves again, another institution may see only the next fragment of the journey.
On-us payments concentrate more of that context inside one institution. Interbank payments divide it. By the time one bank has completed an investigation and shared a finding, the money may already have crossed several institutional boundaries.
This is why faster alert generation is not, by itself, a real-time AML strategy. An alert that arrives after the funds have left may support a valid investigation, SAR or STR filing and eventual account closure. It may still be operationally correct and economically late.
The decision that matters is not whether the bank can run an AML model quickly. It is whether the institution controlling the onward payment can use the available fraud, account and network intelligence while it still has authority over the transaction.
Real-time AML does not mean real-time everything
A credible architecture separates understanding from deciding without pretending that every source of intelligence is equally fresh. A daily AML or GNN process can contribute valuable structural context, but it cannot describe an inbound payment that arrived seconds ago. The architecture therefore needs several tiers of features, each updated at the cadence appropriate to what it represents.
The first tier is event-driven. When the inbound payment is posted, the transaction directly updates the online feature store on IBM Z with what has just changed: the receipt time and value, source account or institution, balance movement, source novelty and the relationship between the incoming funds and the account’s previous activity. These features are available immediately rather than waiting for the next monitoring cycle.
The second tier operates over seconds or minutes. Streaming or micro-batch processing on IBM Z refreshes rolling counts, values and sliding windows; fan-in and fan-out measures; receipt velocity; balance-depletion patterns; and recent beneficiary, device and session behaviour. This tier converts individual events into current behavioural context without waiting for an end-of-day process.
The third tier can be produced off-platform from transaction history replicated through change data capture or streamed into a data lake, lakehouse or analytical platform. A scheduled graph or graph neural network job can construct the account network and publish graph-derived features back to the online feature store on IBM Z. These might include account or node embeddings, community membership, proximity to known mules, network-risk scores and longer-term mule propensity. Customer-risk models, confirmed cases and investigation outcomes contribute other features at their own cadences. These slower-moving features remain valuable, but their timestamps, lineage and expiry must travel with them so that a daily graph result is not mistaken for current transaction context.
The online feature store on IBM Z brings the tiers together. When the outbound payment is attempted, inference retrieves the latest event features, rolling-window aggregates and available AML or GNN intelligence, then combines them with the current payment and account state. The objective is not to reproduce a complete AML investigation in milliseconds. It is to operationalise the freshest relevant intelligence before the value of the decision expires.
Intervention is not synonymous with blocking. A confidence-based policy can allow or monitor lower-risk activity, apply additional authentication or a transaction limit when uncertainty is material, and reserve urgent review, a permitted delay, account restriction or prevention for stronger combinations of evidence. The decision must be proportionate to the potential harm and supported by clear reason codes, thresholds, ownership and escalation paths.
This is also where the customer-harm and tipping-off problems become operational rather than theoretical. A legitimate customer may be trying to use their own money at the moment the control intervenes. The bank therefore needs defined service levels, carefully designed customer communications, rapid resolution and jurisdiction-specific legal guidance on what can be disclosed. A model score alone cannot determine that policy.
The objective is not maximum intervention. It is the minimum proportionate friction needed to prevent potentially irreversible movement while preserving legitimate access. False positives, abandonment, complaints, review capacity and the duration of any restriction are therefore part of the control design, not secondary implementation details.
Real-time AML is therefore a decision architecture. Most intelligence may be created outside the transaction path. The consequential decision cannot remain disconnected from it.
Where IBM Z fits
For banks whose account, payment or authorisation workloads run on IBM Z, the platform may already own the live balance, account state, payment workflow and final authorisation decision. IBM Z brings low-latency inference into the trusted transaction path alongside the applications, data and online feature state that determine whether the payment proceeds.
Inference close to the operational workload can combine the current transaction with governed features without making the decision dependent on a remote network call or repeated movement of sensitive transactional data. It also keeps the decision within the bank’s established transactional controls, availability model, security boundary and audit trail.
This does not displace incumbent AML monitoring, investigation or case management. It gives those analytical flows, and any adjacent graph analytics, a governed route into the live payment decision. IBM Z adds the event-driven and near-real-time tiers that keep the feature state current between scheduled graph runs.
At the onward hop, IBM Z consumes that tiered feature state alongside the outbound transaction. Its role is to combine longer-term AML understanding with what has happened to the account in the last day, minute and millisecond, at the moment the bank still controls the outcome.
This distinction protects the argument from becoming a technology-led use-case search. A runtime without a qualified decision is not an AML strategy. The starting point must be the bank’s actual movement-of-funds journey: where risk is recognised, how quickly it becomes available, which system controls the onward payment, what intervention is legally and operationally permitted, and how outcomes flow back into the models and investigations.
Following the money to the next decision
The conventional objection to real-time AML contains an important truth: most AML activity does not need to happen in the critical transaction path. Investigations should not be compressed into milliseconds. Network analysis should not be reduced to a single payment. Regulatory reporting is not improved merely by producing alerts faster.
The mistake is allowing that truth to conceal the exception. Mule accounts connect the fraud that creates a victim’s loss with the laundering process that moves the proceeds beyond recovery. The inbound payment changes what the receiving bank knows. The attempted outbound payment determines whether that knowledge can still change the outcome.
That is why the onward hop deserves attention. The strongest case for real-time AML is not faster compliance. It is the opportunity to connect fraud intelligence, AML intelligence and payment decisioning while the bank still has a decision to make.
